CN110224876B - A method for measuring the effectiveness of DDoS attack and defense at the application layer - Google Patents

Abstract

The invention discloses an application layer DDoS attack and defense utility measurement method. By using the invention, the DDoS attack and defense utility value of the application layer can be calculated scientifically and effectively, and the application, physical and network aspects are fully considered, and the utility value is more comprehensive and objective. Based on the definition of behavior and utility in traditional sociology and engineering, the invention analyzes and defines the attack and defense behavior and utility in the network; maps the logical topology structure of the network system to a multi-dimensional affine space, and the performance indicators of the network nodes are The number is the dimension of the multi-dimensional affine space, and the mapping relationship between the multi-dimensional hyperparallel and the state of the network node in the multi-dimensional Euclidean space is proved. Based on this, it is proposed that the state value of the network node is the corresponding multi-dimensional hyperparallel At the same time, in the selection of indicators, the application, physics, network and other aspects are considered, and the DDoS attack and defense role of the application layer is more objectively and comprehensively considered.

Description

A method for measuring the effectiveness of DDoS attack and defense at the application layer

technical field

The invention relates to the technical field of cyberspace security, in particular to an application layer DDoS attack and defense utility measurement method.

Background technique

Distributed Denial of Service (DDoS) attack is an irreversible and avoidable attack method. Among them, the most complex form of distributed denial of service attack is application layer DDoS attack. Application layer DDoS attack usually prevents it from providing normal web services to legitimate users by occupying a large number of request queues of web servers. How to comprehensively analyze the impact value of an attack from the perspective of the network itself and users, and how to provide just-right defenses to avoid wasting resources when an attack occurs is a difficult problem to solve at present. In order to solve this problem, it is necessary to measure and evaluate the security of the network system while fully considering the security of the network system design stage. However, in traditional network security assessment techniques, subjective human factors are often unavoidable. In the current application layer DDoS attack impact assessment technology, the main evaluation calculation method is to calculate a certain definition proposed in the method that can represent the attack impact through the analysis of various observation indicators. In the current methods, one is that the definition is lack of a basis for combining with existing mature theories; the other is that few intuitive results are obtained to quantitatively calculate the attack impact value; the third is that there is almost no research on the defense impact value analysis, lack of certain reference value.

For example, the patent application "A method of network security risk assessment" (publication number: CN107204876A, inventors: Gao Qiang, Huang Yuanfei, Lin Xingchen, etc.) adopts a combination of intrusion detection system, vulnerability detection and real-time attack events obtained by a third party. The security of the target network is dynamically assessed on the basis of risk assessment. This method is based on the static risk assessment of the target network, and the static assessment results are given. Furthermore, the dynamic changes of threat and vulnerability information are analyzed with the help of corresponding tools, and the alarm information generated by the intrusion detection system and the firewall is used as an important basis for evaluating the risk status of the system. The evaluation of this scheme needs the support of static risk evaluation results, and the evaluation of static risks will inevitably be affected by subjective factors, so that the evaluation results are not completely objective.

Patent application "A Quantitative Network Security Protection Strength Evaluation Method" (Publication No.: CN108566307A; Inventors: Li Xiaoyong, Guo Yu) By collecting software behavior characteristics in network nodes, the software behaviors of some nodes are randomly selected from the software behaviors The features are trained as software behavior analysis training data to generate a network security analysis model. The machine learning algorithm is used to analyze and evaluate the software behavior characteristics of all nodes in the software behavior characteristic database, and finally calculate the quantitative network security protection strength evaluation result. However, in the process of software behavior feature selection in this scheme, the selection of software behavior analysis training data is part of the node data randomly selected in the software behavior database. Therefore, to a certain extent, the selection of software behavior features is not comprehensive enough, resulting in comprehensive and overall evaluation results. Sex is not rigorous enough.

Patent application "A Computer Network Security Assessment Based on Description Logic" (Publication No.: CN105812381A; Inventors: Wang Tao, Xu Chao, Liu Xiao, etc.) The logical derivation rules are used to describe the structural relationship of the local area network or other security systems, and based on this, the security level of the target system is deduced and quantitatively analyzed. On this basis, a security assessment formula is formed, and the network security assessment value is obtained through calculation. The patent application does not give a description of the specific quantification formula, but only proposes to use the safety assessment formula generator to generate the corresponding formula, without specific mathematical model support.

Therefore, it is currently difficult to assess the impact of application-layer DDoS attacks and the role of defensive measures.

SUMMARY OF THE INVENTION

In view of this, the present invention provides an application layer DDoS attack and defense utility measurement method, which can scientifically and effectively calculate the application layer DDoS attack and defense utility value, and fully considers the application, physical and network levels, and is more comprehensive and objective.

The application layer DDoS attack and defense utility measurement method of the present invention includes the following steps:

Step 1, constructing an index matrix, the index matrix is a diagonal matrix, and the items on the diagonal are respective indexes of the server; wherein, the indexes include application layer indexes, network traffic indexes and hardware performance indexes;

Step 2, collect the index values of the server under different attack and defense effects, and obtain the state value of the server based on the index matrix constructed in step 1; wherein, the state value of the server is the determinant of the index matrix;

Step 3, the change of the state value of the server under attack and defense compared to the state value of the server under 0 attack and 0 defense is the attack and defense value of the server; the accumulation of the attack and defense value along time, It is the attack defense utility value of the server.

Preferably, in the step 1, the following 6 indicators are selected: network throughput per second, the number of TCP segments, the number of IP datagrams, the access failure rate, the average response time and the CPU occupancy rate.

Preferably, in the step 3, the attack defense function value of the server is selected from the average value of the attack defense function value of the server within the attack defense function time period.

Preferably, the attack effect value of the application layer DDoS is the ratio of the state value of the server when it is attacked to the state value during normal operation; the defense effect value of the server on the application layer DDoS value is before and after adding the defense measures to the server under the same attack state. The ratio of the difference between the status values of , to the status value when the server is running normally.

Beneficial effects:

(1) Based on the definition of behavior and utility in traditional sociology and engineering, the present invention analyzes and defines the offensive and defensive behavior and utility in the network, and then maps the logical topology of the network system to a multi-dimensional affine space, and the network nodes The performance index corresponds to the dimension of the multi-dimensional affine space, and the mapping relationship between the multi-dimensional hyperparallel and the state of the network node in the multi-dimensional Euclidean space is proved. Therefore, a new calculation of the state value of the network node is proposed. method, that is, the network node state value is the corresponding multi-dimensional hyperparallel volume, so that the network node state can be scientifically and effectively quantified; at the same time, in the selection of indicators, the impact of the application layer DDoS attack and defense on server security is comprehensively considered, including At the application, physical, network and other levels, it can more objectively and comprehensively consider the DDoS attack and defense role of the application layer.

(2) It is proposed to analyze how much each combination of attack type, attack scale, and attack intensity will affect the target system from the perspective of attack function. Resource, with the accumulation of the scale of the attack, how much the attack effect will increase and other factors. Compared with the existing application layer DDoS attack and defense impact calculation methods, the attack effect can provide an objective reference for the threat of the attack in a more specific and practical way. From some perspectives, the calculation of the attack effect has certain practical significance.

(3) From the perspective of the bottom layer of the network to analyze the size of the defense role, the current research field rarely evaluates the security of the network system from the perspective of the defense role. This calculation method can quantitatively calculate the size of the defense effect by comparing the calculation result of the attack effect with the threshold value, and provide a more intuitive reference value of the defense function. The invulnerability of defense functions is also analyzed from the perspective of the quality of defense functions. Through this calculation method, the strength of each type of defense function can be calculated to resist large-scale attacks, which provides an important basis for defense construction.

(4) The impact value of DDoS attack and defense at the application layer is explained from the utility level, and it is proposed to use the time as the upper and lower limits, and use the average attack effect and the comparison result with the defense to obtain the attack and defense utility respectively. Compared with the traditional method, this method emphasizes the importance of the mathematical model, and selects the attack duration as the starting point and the end point of the attack. After calculating the attack effect at each moment, the average attack effect can be obtained. Through the proposal of the average attack effect, on the basis of its rationality, not only the size of the attack effect can be visually expressed, but also the calculation process of the effect can be greatly simplified. . Through the calculation of utility, the impact value of the attack function and defense measures on the network system can be described more reasonably and accurately and intuitively after an application layer DDoS attack occurs.

Description of drawings

Figure 1 is a schematic diagram of network status values.

Figure 2 is a schematic diagram of the calculation of offensive and defensive effects.

FIG. 3 is a flow chart of the measure of attack and defense utility of the present invention.

Detailed ways

The present invention will be described in detail below with reference to the accompanying drawings and embodiments.

The invention provides an application layer DDoS attack and defense utility measurement method. Based on the definition of behavior and utility in traditional sociology and engineering, by analyzing the characteristics of the attack and defense behavior in the network, relevant definitions such as application layer DDoS attack and defense utility are proposed and analyzed. Its properties; then by proving the mapping relationship between the Euclidean space and the network logic topology, the n-dimensional hyperparallel in the n-dimensional Euclidean space is used to describe the network node state, and the size of the n-dimensional hyperparallel is calculated to estimate the network node. The state value of DDoS, the method for selecting metrics, and the related calculation method for application layer DDoS attack and defense utility are proposed, and the application layer DDoS attack and defense function and attack and defense utility are obtained. Finally, the feasibility and accuracy of the method of the present invention are verified by simulation experiments.

(1) Definition of Offensive and Defensive Utility

The present invention analyzes and defines network attack and defense utility from sociological and engineering perspectives: analyzes the definition of behavior from the perspective of sociology, and analyzes the definition of utility from the perspective of engineering. The specifics are as follows: the present invention makes the following definition of offensive and defensive behavior in the network according to the traditional sociological definition of behavior: from the perspective of network objects and their interconnections, offensive behavior or defensive behavior refers to attack means or A series of state transitions caused by defense means in the network, the change of network state caused by the occurrence of the attack process can be described as attack behavior; the weakening of the attack effect caused by defense means and the change of network state can be defined as defense behavior. Combined with engineering theory, the present invention defines the role of offensive and defensive behaviors in the network as follows: the role of offensive and defensive behaviors refers to the reasons why the attack and defense behaviors change the network system through a series of actions within the network system, and the behavioral role The network status has changed. The present invention defines offensive and defensive utility as follows: Utility is a basic metric that characterizes the performance of a system or scheme, and refers to the cumulative amount of action that a behavior acts on an object in a certain space and within a certain range.

(2) Proof of the mapping relationship between network logic topology and n-dimensional affine space

The topology of a computer network refers to the physical structure of nodes and lines formed by computer equipment and transmission media in the network. The nodes are mainly divided into conversion nodes and access nodes, and the transmission medium is the communication link; each network structure is composed of each node and its communication link. Network topology includes physical topology and logical topology. Common network logical topologies include: star structure, bus structure, ring structure, tree structure, mesh structure, etc.

The network logical topology can be mapped into an affine space:

According to the link relationship between the elements of the object set A (the set of each device node in the network system), the elements in the set A can be mapped into the vector space V.

并满足如下条件：The mapping maps any pair of ordered points p, q in A to a vector in V

and meet the following conditions:

(1)

存在唯一的点q∈A,使得

(2)

There exists a unique point q∈A such that

(3)

Therefore, the set A, that is, the set of nodes in the network system, can be mapped into an affine space.

According to the definition of offensive and defensive behaviors, functions and effects of the present invention in (1), it can be known from the analysis of the process of offensive and defensive behaviors in the network system that in a network logical topology structure, each node device can be regarded as an independent network space. In the subspace, according to the normal operation status of the node device and the collection of each indicator value after the attack occurs, each indicator is a dimension. Through the indicator dimension, the direction of each indicator value in the n-dimensional coordinate system in the subspace can be obtained. are perpendicular to each other, so the vector corresponding to each index value is linearly independent in the affine space. Therefore, it can be deduced that the network scene established based on the network logic topology can be described as an n-dimensional affine space, and the scene of a specific network behavior is a subspace of an n-dimensional affine space. Since the affine space is a generalization of the affine characteristics of the Euclidean space, each node in the network can be regarded as an n-dimensional Euclidean space.

(3) Prove the mapping relationship between n-dimensional hyperparallel and network state

During the attack/defense behavior of a node in a network topology, each index item of the node will change, and the index dimension corresponds to the dimension of the affine space, that is, an index item of a device corresponds to the n dimension. A vector in Euclidean space, and n indicators can be described as n linearly independent vectors in Euclidean space. According to the description of the definition of n-dimensional hyperparallel body, it can be proved that these index vector sets are an n-dimensional hyperparallel body stretched by these index vectors, that is, the geometric shape of nodes in the network space in Euclidean space. This geometry can be used to describe network node states. From the physical meaning of the network topology, the occurrence of offensive and defensive behaviors in a network will inevitably lead to changes in each index item of the network node, and in the process of the occurrence of offensive and defensive behaviors of a network node, due to the inconsistency between the various index items of the node There will be a dependency relationship, and its changes are determined by the role of attack and defense, so each index item can be regarded as independent of each other, and the change direction of the index vector in the n-dimensional space is inconsistent, so the index change in the network node is mapped to In the n-dimensional Euclidean space corresponding to the node, it can be concluded that each index is n linearly independent vectors in the Euclidean space, which proves that the network scene can be mapped to an n-dimensional hyperparallel.

(4) Method of selecting metrics

Because application-layer DDoS attacks usually use a large number of request queues of the web server to prevent it from providing normal web services to legitimate users, the attack and defense effectiveness of application-layer DDoS can be measured by calculating the state changes of the server before and after the attack defense occurs. Therefore, in the selection of indicators, the present invention fully considers the application, physical and network levels to reflect the impact of the attack on the server, and selects network traffic related indicators, such as network throughput per second, number of TCP segments, IP The number of datagrams, etc.; hardware performance indicators, such as CPU usage, memory usage, etc.; application layer indicators, such as average response time, access failure rate, etc. The present invention is not limited to the above-mentioned indicators, as long as it can fully reflect the security status, use performance, and the like of the server. In this embodiment, the following six indicators are preferably measured: network throughput per second, the number of TCP segments, the number of IP datagrams, the access failure rate, the average response time, and the CPU occupancy rate. The above six index items can comprehensively describe the DDoS attack at the application layer, and consider the impact of the network layer and hardware layer, which can be used to analyze the impact value of DDoS attack more completely, and the subsequent calculation amount is small.

(5) Calculation methods and mathematical modeling related to DDoS attack and defense utility at the application layer

(1) Calculation method and mathematical modeling of network state value

The idea of network state value calculation method is shown in Figure 1.

The invention regards each device node in the network as each independent subspace in the network space, and takes the device index as the dimension of the subspace and maps it to the n-dimensional space, each index corresponds to a vector in the space, and the value of the node index The change also means that the length of the corresponding vector will change. As can be seen from the foregoing, the network node index vector can be mapped to an n-dimensional hyperparallel in an n-dimensional Euclidean space. Through this geometric model (n-dimensional hyperparallel), the state of the network node can be described, and the n-dimensional hyperparallel volume can be used to describe the state of the network node. Visually describe the current state values of network nodes.

The specific calculation steps of the network state value are as follows:

The first step is to construct an n-dimensional matrix. According to the selection of indicators, it is assumed that n indicators are selected, and the n indicators are respectively m ₁ , m ₂ , m ₃ , ..., m _n . According to the previous argument, each index in the network node is a linearly independent vector in the n-dimensional Euclidean space V. Therefore, n indicators can be mapped to the vector dimension in the n-dimensional space. Taking the preferred 6 indicators in this embodiment as an example, the 6 indicators can be mapped to the vector dimension in the six-dimensional space, and the vectors are respectively expressed as:

Therefore, the 6-dimensional matrix composed of these 6 vectors can be represented as a diagonal matrix, namely:

The second step is to calculate the volume size of the hyperparallel in the 6-dimensional Euclidean space. The volume V(m ₁ ,m ₂ ,...,m ₆ ) of the hyperparallel body formed by the above 6 vectors in 6-dimensional Euclidean space is:

V(m ₁ , m ₂ ,...m ₆ )=V(m ₁ ,m ₂ ,... m ₅ )·h ₆ (3)

其中G(m₁,m₂,…m₆)为格拉姆行列式，D是(m₁,m₂,…m₆)在V的某一组标准正交基下坐标的行列式。where h ₆ is the length of the orthogonal components of the subspace generated by m ₆ with respect to the vectors m ₁ , m ₂ , . . . m ₅ , and V ₁ (α)=|α|, α=m ₁ , m ₂ , . . . m ₆ . It has been proven that:

where G(m ₁ , m ₂ ,...m ₆ ) is the Gram determinant, and D is the determinant of the coordinates of (m ₁ , m ₂ ,... m ₆ ) in a set of standard orthonormal bases of V.

Thus, the network state value at a certain time t is the determinant of the diagonal matrix M obtained in the first step. Suppose the network state value is S _t , and its specific calculation method is:

S _t = |M| (4)

因此网络状态的算术平均值为：The third step is to calculate the arithmetic mean of the network state during the attack. In order to avoid the chance of a certain state, the arithmetic mean of the node state for a period of time is taken to represent the security state of the network node in this period of time. During the duration t _i , i=(1,2,...,m) of the joint action of attack and defense, the network state values at each moment are respectively

So the arithmetic mean of the network state is:

Example 1. Set the 6 indicators of network nodes collected in the state of no attack: network throughput rate, TCP data segment transmission rate, IP datagram transmission rate, average traffic arrival time, CPU occupancy rate, and transaction failure rate are 1 respectively. pcs/sec, 2pcs/sec, 3pcs/sec, 1sec, 1%, 1%, where the average traffic arrival time and transaction failure rate are average. Calculate the state value S of the network node at the current moment.

From formula (1) and formula (2), the current index can form a diagonal matrix M as follows:

From equations (3) and (4), the volume size of the 6-dimensional hyperparallel body mapped by the current network logic topology, that is, the state value of the network node S=|M|=6.

(2) Calculation method and mathematical modeling of offensive and defensive effects

The method of measuring the size of the attack effect is shown in Figure 2.

Based on the attack behavior of the network node and the adopted defense behavior, the state value of the network node will change, and the change of the state value of the network node can be used to describe the attack and defense function and utility of the network node. The attack intensity of the network node is preset to 1, and the defense basis is preset to 0, and the current attack method and the attack effect under the attack intensity are obtained by calculating the change rate of the state value of the network node caused by the attack effect. In the case of setting the initial value of the network node to 0, that is, without adding any defense measures, the attack effect = the state value of the network node. Using this idea, the calculation method of the size of the defense measures can be deduced. Based on the variability of offensive and defensive behaviors, in order to ensure the universality of the calculation results of offensive and defensive effects, we should analyze the change of the attack intensity by judging the size of the attack effect at each moment, and select a certain time period of the attack intensity to obtain the average attack. In order to eliminate the peak value and the lowest value of the attack effect, the purpose of fully describing the attack effect can be achieved.

Under the premise that the time span remains unchanged, the approximate calculation route of the attack effect and the defense effect is shown in Table 1. Table 1 lists the change value of the attack effect caused by the change of the attack intensity when the attack effect has a certain time span, and the change amount of the defense effect caused by the accumulation of the defense measures. In order to more conveniently and clearly illustrate the variation of attack and defense effects with the accumulation of attack strength and defense strength, the data in the table are abstract values and do not represent specific attack strength and defense strength.

Table 1. Simulation calculation table of attack and defense effect size

According to the establishment of the state value calculation model, through the analysis of server performance data records, network analysis, application services and other related indicators, select the nodes with the most stable data fluctuation and within 1-5 hours of the normal user's legal access behavior trajectory. The state value is used as the threshold value selection method of the threshold value, and a segment of the network normal operation state is selected and its state value S ₀ is calculated. When the attack effect occurs, the magnitude of the change in the network state value can be described by the attack effect. That is, after the network is attacked, the change of the network state value is compared with the threshold value.

1. Calculation model of attack effect

计算方法为：Assume that when the attack strength is X, at time t ₁ , the network state value is S ₁ . then the attack effect at each moment

The calculation method is:

The calculation method of the average attack force is:

Example 2. Set the 6 indicators of network nodes collected under normal operation status: network throughput rate, TCP data segment transmission rate, IP datagram transmission rate, average traffic arrival time, CPU occupancy rate, and transaction failure rate are 1 respectively. Pieces/second, 2 pieces/second, 3 pieces/second, 1 second, 1%, 1%, all the above are average values. When the attack occurs, the average size of each indicator value during the attack is 10/second, 20/second, 30/second, 10 seconds, 10%, and 10%, respectively, and the average attack effect is calculated.

The examples given are average values, so the average network state value can be calculated directly. From formula 1, formula 2, and formula 5, the average network state value S _N in normal operation state is

During the attack, the average network state value S _A is

的值为According to formula 7, in the process of this attack, the average attack effect size

value of

2. Calculation model of defensive effect

若在此时向系统内添加了防御措施D之后，网络状态值为S₁′，攻击作用变化为

攻击作用变化量记为

根据公式6推论，则在t1时刻防御作用的计算方法为：Assuming that when the attack strength is X, and no defense measures are added in the system, the network state value is s ₁ , then the attack effect at time t1 can be set according to formula 6 as:

If the defense measure D is added to the system at this time, the network state value is S ₁ ′, and the attack effect changes to

The change in attack effect is recorded as

According to formula 6, the calculation method of defense effect at time t1 is:

The calculation method of the average defensive force is:

Example 3. On the basis of the data in Example 2 above, after configuring a certain defense technology for the target network node, the average size of each indicator value during the attack process is 5/sec, 10/sec, 15/sec, 5 seconds, 5%, 5%. Calculate the size of this defensive effect (results are accurate to two decimal places).

From formula 1, formula 2, and formula 5, the average network state value S _D after configuring defense is

为According to the calculation results in formula 8 and example 2, the average defense effect in the process of attack and defense confrontation

for

(3) Calculation method and mathematical modeling of attack and defense utility

The effect utility value can indicate the total amount of attack on the network node by the attack effect and the total defense ability of the defense effect during the attack and defense confrontation time during the attack duration. In an application layer DDoS attack, the attack traffic of the attacker will not be constant under normal circumstances, and the influence of the traffic in the network is restricted by various factors. Therefore, the representation of the attack effect can obtain the size of the attack at a certain point in time, but it cannot reflect the impact of the attack during the entire attack process. On the basis of the study of the threshold value, the magnitude of the attack effect at each moment can be obtained after the attack occurs. At this time, the attack utility can indicate the impact value of the attack type during the entire attack process. That is to say, the utility is The sum of the effects is the cumulative amount of the attack effect over time. Let the attack effect size be F, when the threshold is set and selected, the attack effect is 0, and the attack effect is also 0. If an attack occurs, let the attack action at t1 be F1, the attack action at t2 be F2, and the attack action at tn be Fn. Based on the setting of the threshold, the calculation method of the attack utility E is:

The utility value of offense and defense represents the cumulative amount of offense and defense, because in the process of offense and defense, the roles played by attackers and defense means cannot be constant in actual operation. Therefore, in the evaluation process, it is necessary to obtain the utility value of the two effects in the whole process, that is, the utility value can indicate the total effect of the offensive and defensive effects in the offensive and defensive process.

平均防御作用力为

则攻击效用E_A以及防御效用E_D的计算方法分别为：According to the calculation results obtained by formula 7 and formula 9, set in the attack duration t, the attack strength is X, the defense strength is Y, and the average attack force is recorded as

The average defense force is

Then the calculation methods of attack utility EA and defense utility _ED are _:

According to the calculation result of the utility value of offense and defense, we can get how much the attack effect of the current attack type can be resisted by the defense measure, so that the concept of defense efficiency can be put forward. According to formula 10, when the defense is 0, it can be concluded that within a certain time t, the attack utility value is E _A . After the current system settings are added to defense measures, the attack utility is E _A ′. Then the calculation method of defense efficiency _DE is:

Example 4. Based on the hypothetical data in Example 3, set the duration of the offensive and defensive confrontation to be 60 seconds, and calculate the respective sizes of the offensive and defensive utilities EA and _ED and the defensive efficiency _DE in this _process .

According to formulas 11 and 12, in the process of offense and defense confrontation, the respective sizes of offense and defense utility are:

The size of defensive efficiency D _E is:

To sum up, the present invention obtains a series of specific index items through data collection methods such as performance monitoring, traffic statistics, and data packet interception, and then uses the combination of these index data to quantitatively describe the state of each network node, so as to calculate each The state of the network node at the time of the attack. According to the change of the network node state, the size of the current attack and defense effect can be analyzed and calculated, so as to obtain the attack and defense utility value. The specific flow chart is shown in Figure 3.

To sum up, the above are only preferred embodiments of the present invention, and are not intended to limit the protection scope of the present invention. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included within the protection scope of the present invention.

Claims (4)

1. An application layer DDoS attack and defense effectiveness measurement method is characterized by comprising the following steps:

step 1, constructing an index matrix, wherein the index matrix is a diagonal matrix, and items on the diagonal are indexes of a server respectively; the indexes comprise application layer indexes, network flow indexes and hardware performance indexes;

step 2, acquiring index values of the server under different attack and defense effects, and acquiring a state value of the server based on the index matrix constructed in the step 1; the state value of the server is a determinant of the index matrix;

step 3, the change quantity of the state value of the server under the attack action compared with the state value of the server under 0 attack and 0 defense is the attack action value of the server; the accumulation of the attack effect value along the time is the attack effect value of the server; the ratio of the difference of the state values of the server before and after the addition of the defense measures to the state values of the server under 0 attack and 0 defense in the same attack state is the defense effect value of the server; and accumulating the defense effect value along the time, namely the defense effect value of the server.

2. The method for measuring utility of DDoS attack and defense at an application layer according to claim 1, wherein in step 1, the following 6 indexes are selected: network throughput per second size, number of TCP segments, number of IP datagrams, access failure rate, average response time, and CPU occupancy.

3. The application layer DDoS attack and defense utility measurement method according to claim 1, wherein in step 3, the attack effect value of the server is selected as an average value of the attack effect values of the server within an attack effect time period; and selecting the average value of the defense values of the servers in the defense time period according to the defense values of the servers.

4. The utility measurement method of DDoS attack and defense in application layer according to claim 1, wherein the attack effect value of DDoS in application layer is a ratio of a state value of the server under attack to a state value under normal operation; the defense function value of the server to the application layer DDoS is the ratio of the difference of the state values of the server before and after adding the defense measure under the same attack state to the state value of the server in normal operation.

Images